Integrating a Continuous Feedback Loop DSE Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A team wants to add a security feedback gate to their CI pipeline, but they are concerned about slowing down developers. They have a mix of high-risk and low-risk changes. What is the best way to balance security feedback with developer velocity?

   • ARun fast, non-blocking scans on every commit and run deeper scans only on merge requests to the main branch.
   • BRun all security scans only on the main branch after merge.
   • CRun all security scans on every commit and block the build on any finding.
   • DDisable all security scans during the development phase and run them only before a production release.
   Reveal Solution Discussion Select an answer first
2. 37application · medium

   A DevSecOps team wants to improve security posture by learning from past incidents and near-misses. They have implemented a feedback loop that collects data from incident reports, monitoring alerts, and post-mortems. What is the primary purpose of this continuous feedback loop?

   • ATo continuously improve security and operational processes by using collected feedback to drive changes
   • BTo generate a weekly report for management without any follow-up actions
   • CTo ensure that all incidents are automatically resolved without human intervention
   • DTo replace the need for security audits and compliance checks
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   A company has a DevSecOps pipeline that includes security scans, but the development team often bypasses the scans by pushing directly to the main branch. The security team wants to enforce the feedback loop, but the development team argues that the scans are too slow and block urgent fixes. What is the best way to resolve this conflict?

   • ARemove the scans from the pipeline to avoid slowing down the development team.
   • BImplement branch protection rules that require scans to pass before merging, and optimize the scans to run faster.
   • CLet the security team manually review every change before it is pushed to main.
   • DAllow direct pushes to main but run scans after the merge and roll back if a critical issue is found.
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A DevSecOps team wants to measure the effectiveness of their continuous feedback loop. They have been tracking the number of vulnerabilities found in production, but the number has not changed over the past quarter. They suspect the feedback loop is not working. What is the most likely reason for this lack of improvement?

   • AThe feedback loop is collecting data but not acting on it to remediate issues or improve processes
   • BThe team is not holding enough security meetings
   • CThe team is not using enough security tools
   • DThe team is tracking the wrong KPI
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A company's CI/CD pipeline runs unit tests, SAST, and dependency scanning. The team notices that developers often ignore warnings from the dependency scanner because the pipeline still succeeds. They want to ensure that critical dependency vulnerabilities block the release. What is the most effective way to integrate this feedback into the pipeline?

   • ARun the dependency scanner only on a nightly schedule
   • BSend the dependency scan report to the security team for manual review after each build
   • CAdd a comment to the build log listing all vulnerabilities
   • DConfigure the dependency scanner to fail the pipeline when a critical-severity vulnerability is found
   Reveal Solution Discussion Select an answer first